Analysis
-
max time kernel
190s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:38
Static task
static1
Behavioral task
behavioral1
Sample
e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4.exe
Resource
win7-20220901-en
General
-
Target
e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4.exe
-
Size
779KB
-
MD5
9f49665018215bb52edd1f83d7a3e911
-
SHA1
30fc77c613dc0154c183c10d6c3a0c3bde5b7c3f
-
SHA256
e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4
-
SHA512
5fae5817f671186ff12f6bf82a88bf1952f271daea64b51800edb33aef3d28b16bb8709689af1976ffbd75d2b51b051860a69ecab9135a118e217b267ea5ff88
-
SSDEEP
12288:h1OgLdaOo5EaQpHXfierkG+GYdT1xiG4jCLrZJ:h1OYdaOa7QJkxGYNiub
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ZCjgxcGZPliUnjN.exepid process 2640 ZCjgxcGZPliUnjN.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
ZCjgxcGZPliUnjN.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojmmnceaidnmminjjffpndcbdibelgam\155\manifest.json ZCjgxcGZPliUnjN.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojmmnceaidnmminjjffpndcbdibelgam\155\manifest.json ZCjgxcGZPliUnjN.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojmmnceaidnmminjjffpndcbdibelgam\155\manifest.json ZCjgxcGZPliUnjN.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojmmnceaidnmminjjffpndcbdibelgam\155\manifest.json ZCjgxcGZPliUnjN.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojmmnceaidnmminjjffpndcbdibelgam\155\manifest.json ZCjgxcGZPliUnjN.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4.exedescription pid process target process PID 1800 wrote to memory of 2640 1800 e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4.exe ZCjgxcGZPliUnjN.exe PID 1800 wrote to memory of 2640 1800 e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4.exe ZCjgxcGZPliUnjN.exe PID 1800 wrote to memory of 2640 1800 e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4.exe ZCjgxcGZPliUnjN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4.exe"C:\Users\Admin\AppData\Local\Temp\e602e10060cff00c86447403a58939695f12af586e89cc8b18daf36c556dd3d4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ZCjgxcGZPliUnjN.exe.\ZCjgxcGZPliUnjN.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
PID:2640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ZCjgxcGZPliUnjN.datFilesize
1KB
MD567fe1f14225e896e8b6d29ae79879ac6
SHA11fcff508e8adf6362d451d4b76a1bcd45bc70b67
SHA256ece981267a58bbd74abc97f81f05f3e22cb99ec5c17f7b1b321fc26a17a46b6c
SHA512b40f8306d44cb748d557a6df0e43010639224fe453212b15fc160c199bf585df17c14fc403a6fe34a2856849adc9499c2794744cca46c16bfc73310240b4dfdc
-
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ZCjgxcGZPliUnjN.exeFilesize
632KB
MD5c40cbd955bd3bbbf7de8218b95004eeb
SHA1fe5fccf0a2166f1fc11812de679d77475e9deb36
SHA25676dbb3388f2339883bb20fdf6330e77b12f4493976ec5b2649d7427429c92398
SHA5126fee70cceeee8ba54d3fcda5e94ef3a98f1c51c79673b46081fd00793ad0f99fe0111bdcb7fee2e13aa10a1d51d94a5b41a1426389bc0c6ce0297b93ba3f13ba
-
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ZCjgxcGZPliUnjN.exeFilesize
632KB
MD5c40cbd955bd3bbbf7de8218b95004eeb
SHA1fe5fccf0a2166f1fc11812de679d77475e9deb36
SHA25676dbb3388f2339883bb20fdf6330e77b12f4493976ec5b2649d7427429c92398
SHA5126fee70cceeee8ba54d3fcda5e94ef3a98f1c51c79673b46081fd00793ad0f99fe0111bdcb7fee2e13aa10a1d51d94a5b41a1426389bc0c6ce0297b93ba3f13ba
-
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ojmmnceaidnmminjjffpndcbdibelgam\FPL3z.jsFilesize
6KB
MD56cb9cc2f21f01e59223c62d538d6d5de
SHA1c8875a19cf1d59de891c06ff772a955b5a6cfd3a
SHA25619fad6a6ab48927f15cea29b5fb823339645ecdd8f129941604f0ddaad695c05
SHA51251849c946c8e5678b27fb3c788e2902242f66fe2fb5150af831ab07904ed03873e7d1114d187c034b47fe13500d21f81356bdb3caa7e989e5d15999e37ced6e4
-
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ojmmnceaidnmminjjffpndcbdibelgam\background.htmlFilesize
142B
MD5a19ed8836763a8a3506b6ed1ae1dbe36
SHA196411f94fe7b4e1adc29532fddcf17d121bcec6b
SHA256791697cfb928b836c268c0a774a7d9554c56267e14169d528aab0637744d94cf
SHA512980de81412a85127a83e9a1e06d8a3a5c95e60183da5d3b76ec0bd422c67c1c461904f3ea055502412040913802a6f5ae0f003ab063f9b1d13474d24def25b15
-
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ojmmnceaidnmminjjffpndcbdibelgam\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ojmmnceaidnmminjjffpndcbdibelgam\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSF4EF.tmp\ojmmnceaidnmminjjffpndcbdibelgam\manifest.jsonFilesize
602B
MD5a6a8f185e80b322e7bae7836244e0247
SHA182d2b57031d63666500f9518668b37da76b1ebdd
SHA2567b3f7dc190683c08e04be8f59684ee5f0ab07f313a9c2a271d7668f42c21a498
SHA51263b2604e763ee3272b73653aa62f360200a062ef4c87c15b3a64fa26fbeb359813c4707ad4860ae54445f3b8e3e770cf389fbf5ed2cfb2491093f09466553f24
-
memory/2640-132-0x0000000000000000-mapping.dmp